Step 8: Emulating Ink Cartridges

For the past two years, I’ve been planning to build myself a 3D printer from some old Inkjet printers that I had collected over the years. But not until two weeks ago had I actually started to work on it.

The 3D printer I want to made uses a ink jets to print a chemical onto a building platform. The building platform goes down as a new layer of powder is spread onto it. Then a chemical is sprayed from the print head that will cause powder to bind. If you want more information on these kinds of printers look here

My printer of choice was an old Epson Stylus C63 for these reasons:
1. The ink cartridges only supply ink, they do not have ink jet nozzles themselves
2. I can attach rubber hoses or some other form of tubing that allows me to print another chemical of my choosing
3. The print head nozzles uses a piezoelectric material to produce droplets of ink (lasts much longer than thermal inkjets)
4. Most service manuals for Epson Printers come with a detailed schematic of the main board.

Note: Due to certain circumstances, this printer had already been pulled apart.

The first thing I needed to do was get my printer running so I could plug my logic analyser in and look at the signals, the problem was that I was missing one ink cartridge so the printer refused to print, or do anything.
Due to my budget (jobless and about to start university) I decided to try and Emulate the missing cartridge, or all of them using one microcontroller, thus allowing me to move forward and using water for the print head instead of ink that stains.

Step 1: Getting familiar with it

So in order to emulate the ink cartridges, I need to know how they work first. Luckily the ink cartridges in my printer have simple EEPROMs that hold the ink usage and other important information about the ink cartridge such as the expiration date, colour, serial number and so on.

Inside the print head, there is a circuit board with pads mapped out that are an exact mirror of the pads on the ink cartridges and a ribbon cable that connects this board up to the main board on pins 1 to 6.

A quick look at the schematic for the main board reveals that pins 1 – 6 are named CVDD, CSDA, CRST, GND, CSCK and COI.

With these signal names I decided it would be best to draw out a schematic of the connecting board as it was not present in the service manual. This revealed that CSDA, CSCK, CRST have 100KOhm Pull-Down resistors, a bit unusual in my opinion as it’s not like I2C (uses Pull-Up Resistors typically 1.8KOhms to 47KOhms). The COI signal connects serially to the ink cartridges but on the end is shorted to GND. Curiously I tested the continuity of the pads on the ink cartridges and found that they are shorted, this means that when COI is grounded, all ink cartridges are present.

Step 2: Signals

Now that I know the signal names, I wanted to see what the signals themselves looked like.
I got out my soldering iron, a ribbon cable (used to be an IDE cable from an old computer) and a craft knife. I cut 6 wire wide ribbon cable about 30cm long, stripped the ends carefully using the craft knife (a lot easier to use a craft knife to strip a ribbon cable than a pair of clippers or pliers), and soldered them onto the circuit board that mates with the ink cartridges.
I also stripped the other ends and soldered on some pins so I could plug them into my logic analyser.

After plugging in the logic analyser into the circuit board and having a look at the signals, I found that immediately the SCK, SDA look nothing like I2C, I’m pretty sure that Epson must have invented their own serial protocol for talking to the EEPROMs inside the ink cartridges.

What I found is that CVDD gets powered up and shortly after, CRST and CSDA go up at the exact same time shortly followed by CSCK which pulses. CSDA changes on the Rising Edge of the CSCK and I’ll assume it gets read on the Falling Edge.
CSCK is Serial ClocK
CSDA is Serial Data
CRST is Reset
and CVDD is the power
Looks easy enough but I wanted more information about this protocol, were there any addresses being sent?

I turned up the sample rate on my logic analyser and found that there are 4 clock cycles, a pause, then 8 cycles, pause, 8 more and so on. The 4 clock cycles at the beginning gave me the idea that the first four could possibly be a 4 bit address of the ink cartridge. Still a lot of information was unknown about this protocol. So I did some research!

Googling around found nothing about this protocol, the next best place to look was in patents.
Yes, patents, I searched for "Epson SDA SCK RST memory eeprom" on http://www.freepatentsonline.com/ and one of the patents I found (US7660008 ) contained exactly what I was looking for. It outlined the SCK, SDA, RST and VDD of the protocol.
I’ll save you the hassle and point out what I found:
1. Flow chart diagrams describing what the Host and Slave does
2. A timing diagram of the protocol
3. The first 3 bits are a 3bit address followed by a Read/Write bit (Read = 0, Write = 1)
4. The address counter always starts at 0x00 and increments by 1 every clock cycle (This must mean it writes in bits, not bytes)
5. The moment RST goes low, the EEPROM stops everything and resets itself
6. There are 252 bits to read, the last 3 bits (actually they’re at the start) is the address of the ink cartridge.

Using what I had found, I decided to start writing code

Step 3: Basic Code Routines

What I wanted to do was read out the ROMs from the ink carts and then use those to try and emulate the missing ink cartridge I don’t have. This means creating a library that will act as a host to read the data but can also be used to emulate an ink cartridge.
Using previous knowledge from creating software based protocols, I created a header file with these functions:
• extern void epsnCartInit(void);
• extern void epsnCartStart(unsigned char addr, unsigned char write);
• extern void epsnCartStop(void);
• extern void epsnCartWrite(unsigned char data);
• extern unsigned char epsnCartRead(void);

I also created the following definitions that help with remembering which pin was what:
For you microcontroller, you will need to modify these values to suit your application

The start function pulls VDD high, waits, then sets SDA according to the address bit as well as SCK. Waits, pulls SCK low, waits yet again and then pulls SDA high accordingly to the address. This repeats 2 more times except on the 4th time, SDA is set Low because we want to read the data in the EEPROMs not write.

LATAbits.LATA0 = ~LATAbits.LATA0; //Flash an LED by toggling it on and off

DelayMS(500); // A delay function I've created
}
}

This was set up with a 3.3V power supply because the ink cartridges run on 3.3Volts

Why a hello world program? Well, every time I set up a new project on a bread board, I always want to make sure I've got the configureation bits correct and that I'm not getting garbage in the terminal.

I think this is good practice and everyone should do it! :P

If your chip is doing something simple like mine, Great!! on to the next step

Step 5: Implementing Our Library

Now we want to include the library we created for interfacing the microcontroller to the ink cartridge.

At the top of the file add:#include "epsnCart.h" // the name of the header file we created earlier

Since this microcontroller is pretending to be the host, it's controlling the SCK, SDA and RST signals. so make sure they're outputs, add this with the other TRIS registers inside main():

epsnCartInit();

The next bit of code is what I used inside of the while(1) {
It requests an address starting at 0x00 then increments by one after 32 read bytes:

i = 0;
while(i<32){ // keep looping until i is no longer less than 32
sprintf(string,"0x%02X,",epsnCartRead());
putsUSART(string);
i++;
}

epsnCartStop(); //brings RST back low

putrsUSART("\r\n");

addr++
if(addr>7){
addr = 0;
}
DelayMS(500);
}
}

You're probably looking at the line "sprintf(string,"0x%02X,",epsnCartRead());" and going "Huh?"
sprintf is a string formatting function, much like printf except saves the formatted string into the variable string.
"0x%02X," will return a string with a readable hexadecimal value eg: 0xFE and epsnCartRead() returns a value that was read from the ink cart

This was set up with a 3.3V power supply because the ink cartridges run on 3.3Volts

I programmed this to my microcontroller, disconnected the print head from the printer to prevent interference.
I then plugged in the 3 ink cartridges I had and turned it on.

Note: At this point, if you ran this code for the first time, I would expect you have problems. Like me, I've gone over the code dozens of times, changing it here and there to make it work. It's normal if it doesn't work the first time for you. It's a great learning experience figuring out what went wrong! :P

Now, see here how only the odd address returned data except 0x05?
That's because 0x05 is the address of the Magenta ink cartridge which I don't have sadly :(

Step 7: Emulation Code Routines

Now the fun part!

I need the printer to think that there are four ink cartridges installed, to do this we need to implement some emulation functions first. Again from previous knowledge I have predefined these in the header:

epsnCartReady is a macro that is used check if the printer has RST set high.epsnCartGetAddr returns the address that the print head is requesting.epsnCartOut is used to send data to the Host controllerepsnCartIn is used to receive data from the Host when it’s writing

So this time, instead of controlling the SCK to go high or low, we need it to wait for it to go high or low, but if the reset goes low, then stop everything and return:

unsigned char espnCartGetAddr(void){
char i=0;
char temp = 0x00;

while((i<4) && _ecRST){ // Loop while i < 4 and RST is HIGH
temp>>=1; // Right Shift Temp by one
while((!_ecSCK) && (_ecRST)); // Wait for the clock to go high
if(_ecSDA){// only if SDA is high
temp |= 0x08; // then set the 4th bit
}
while((_ecSCK) && (_ecRST));// wait for the clock to go low
i++; // increment the counter
}

while((i<8) && _ecRST){ // Loop while I < 8 and RST is high
while(!_ecSCK && _ecRST); // Wait for SCK to go high
_ecSDALat = temp&0x01; // Set SDA high or low according to the first bit

while(_ecSCK && _ecRST); // Wait for SCK to go low
temp>>=1; // Right shift the data by one
i++; // increment the counter by one
}
_ecSDATRIS = 1; // Set SDA to an output
_ecSDA = 1; // not sure if this is needed
}

And finally the In function:

unsigned char epsnCartIn(void){
unsigned char i=0;
char temp = 0x00;

while((i<8) && _ecRST){ // Loop while I < 8 and RST is high
temp>>=1; // Right Shift the temp by one
while(!_ecSCK && _ecRST); // Wait for SCK to go High
if(_ecSDA){ //only id SDA is high
temp |= 0x80; // Set the 8th bit
}

while(_ecSCK && _ecRST);// Wait for SCK to go low
i++; // Increment the counter by one
}
return temp; // return what we have received
}

Step 8: Emulating Ink Cartridges

So what happens now is that we need to set up our microcontroller to contain the data we have dumped. Then allow the printer host to read and write to it.

Now the problem with this is that I don’t want my fake ink cartridges to ever get used up, so to do that is we have a fixed dump that the microcontroller will load into ram everytime it starts up. This will allow the printer to not only read, but write to it as well. When the microcontroller is powered off then back on, the previous data is restored. (Double Bonus)

Storing data arrays in the microcontroller, place this somewhere under the include, but before void main()

Note: This may vary between different microcontroller families, but it works nicely with my PIC18F

Note: Noticed that I don’t have Magenta? That’s because that’s the ink cartridge I don’t have.

The next step is to write a routine that checks which ink cartridge is being requested, and allow the host to read and write to it.
This is how I did it:

void main(){
unsigned char* inkPtr;
char addr = 0x00;
...

While(1){

epsnCartStartListen();

while(epsnCartReady()==1); // Wait for the Ready signal to go back to low

while(epsnCartReady()==0);
addr = espnCartGetAddr();

if(addr&0x7 == 0x01){ // if the first 3 bits is equal to 0x01
inkPtr = &black[0]; // Point to the black data
}else if(addr&0x7 == 0x03){ // if the first 3 bits is equal to 0x03
inkPtr = &cyan[0]; // Point to the cyan data
}else if(addr[i]&0x7 == 0x05){
inkPtr = &cyan[0]; // This is meant to be Magenta, but I don’t have that
}else if(addr[i]&0x7 == 0x07){
inkPtr = &yellow[0];
}else{
continue: // Go back to the beginning of the main loop because we don't know this address
}

if(addr&0x08){//WriteMode – Check to see if the Host wants to write
while(epsnCartReady()){//keep looping until RST goes low
*inkPtr = epsnCartIn();
// the data the pointer is pointing to
// gets written with new data
inkPtr++; // Increment the Pointer
}
}else{//Read Mode
while(epsnCartReady()){
epsnCartOut(*inkPtr);
// Output the data the Pointer is pointing to
inkPtr++; // Inrement the pointer
}
}
}
}

Success!
After programming this new code and turning on my printer, the printer accepted 4 imaginary cartridges thanks to my microcontroller. I'm also quite shocked that I accepted the cyan ink cartridge data for magenta aswell!

This is a huge achievement for me as this is my first real world reverse engineering I’ve ever done and I got promising results.
Now I can continue with turning the printer into a 3D printer

I hope you guys liked this, this is my second instructable and this took me a while to write :P

If you wan, you guys are more than welcome to download the source files

<p>Wait. I did not get it. you try to emulate a cartridge. Wouldnt it be much easier to tell the cartridge it is filled? (with whatever)</p><p>So it can keep its way of comms with the printer. Maybe I missed something special.</p><p>Sorry if that is the case.</p>

Hej, I tried out communocation with a cartrige with AT45. Damn this protocol is so messy and redundandly &quot;different&quot;. Best example for 'security by obscurity'. Did You ever manage the cartridge to respond?

Hej, I tried out communocation with a cartrige with AT45. Damn this protocol is so messy and redundandly &quot;different&quot;. Best example for 'security by obscurity'. Did You ever manage the cartridge to respond?

<p>Wow, thanks for this. It's exactly what i'm after :)</p>

<p>wow!!!</p>

R 1,R 2,R 3,R 4,R 5=? <br>C 1-C 2=? <br>Crystal=?

This is the closest thing to what I wanted. I wanted to know how to directly interface to an ink cartridge.

Also, I would like it in Wiring language so I can use it with my Arduino.

Hello , Im thinking of making a design to color plastic fillament and I thought that ink jet cartridges would do for such a thing , though I dobt know how they work and how I can communicate with them using the small pcb they have .I also thought that the cartridges should be from epson since I like their shape and it would be neat .So can you provide me with the information I need to control them?<br>If so please , please send me an e-mail at theohacker@hotmail.com<br>Thanks by the way ...<br>

Hey, <br><br>I haven't had much time to work on my printer project all year so I don't know how to control the print heads just yet. What I can say though is that you will definitely need the control circuitry on the printer's main board because it provides the correct voltage levels and wave forms that are needed to drive the Piezoelectric print heads.<br><br>The good news is however that University had just ended and I'm now on my summer break meaning more time to work on my own stuff. I'm sure that during that time I would be able to figure out the control signals and have it print &quot;Hello World&quot; or something on a piece of paper :P<br><br>I'm sorry I can't be of much help at the moment =(

Hey<br> <br> This is interesting, although I currently don't have any need for reverse engineering... but who knows. Maybe some day in the future.<br> <br> Re 3D printers - I am building on, a standard Mendel from the open source Reprap project www.reprap.org<br> <br> Although reprap primarily looks a FDM (laying down layers of plastic) I am sure it would be a valuable resource for you to proceed with your build. I have recently seen a demo video of a printer building with this approach and thought it may be a simpler method over FDM. But then again, you need some method of laying a even layer of the build material down each time. Are you looking at a dropping bed or a raising head? Dust management might also be interesting :)<br> <br> good luck with your build. Looking foreward for more info.

Hey, Thanks for your reply :)<br><br>When I do get around to building the build platform. it will be a bed that drops for each layer printed. <br>I haven't really thought about dust management at this stage because I have yet to build something that prints first :P<br><br>Cheers<br>roman

Which logic analyzer are you using?<br><br>Thanks...

how do you control nozzles of printhead?<br>

hi!<br><br>I'm a student . now i am begin to do my project about 3d printing.i have very much difficult about printer head.I try to search information, how to control print head .but i don't see. fortunately, to day i written your project.I found very interesting. i hope you can shared for me about your experience,tell me more than information about your project.<br>and please give me some document to <br>tranngoclinh.cdt@gmail.com.<br><br><br>thanks you very much.

Roman,<br><br>I have some interesting auto reset ink cartridges for you.<br>I can get you for free.<br><br>Check the video and let me know if this can help you on this project.<br>http://www.ufosystem.net/<br><br>Our ink refill solution will auto reset the ink level to 100%, and you can refill the ink without removing the ink cartridge.<br>Anyway, let me know if you need it. It is free for you.<br>(email me at info@timelinedigitalic.com)<br><br>Charles

Hey Charles,<br><br>Thanks for the offer but I will have to turn it down. My printer didn't want to work without all ink cartridges present, that's why I emulated them all so I could continue with my 3D printer project.<br><br>The print head in the end will be printing chemicals to bind powder together, not ink. So ink cartridge reset will not be of any help to me, sorry.

this is so awesome, I hate my epson, 1, it drains the ink every time i turn it on or 2. it simply does nto work, 3. will only work with all colors full (I only use black, but somehow the colors get used up too)<br><br>thank you for doing this.

Yeah, Epson printers are trouble makers but I'm choosing it because of the technology it uses.<br>Not only will my hack help me with my long term project, but it will also mean no wasting expensive ink :P<br><br>Word of warning though, If you try to use this on your own Epson printer, I can not guarantee the protocol is the same or the pin out of the ink cartridges. But if you do get it to work, you will need to isolate the inks EEPROMs so that they do not interfere with the microcontroller...<br>Or<br>Analyse the dumped data and see if you can find what bytes contain the ink usage, and reset it to full :P (Might post this up later myself)